Privacy policy

01Who we are

CashSpell is made by Gamify Apps ("we", "us"). This policy explains how the CashSpell apps for Android, iPhone and the web, and this website at cashspell.com, handle information about you.

02What you enter

To track your spending, the app keeps the things you write into it:

• accounts, their names, types, currencies and balances;
• transactions, including amounts, dates, payees, notes, categories and tags;
• budgets, goals, debts, repeating entries, templates, rules and categories you create;
• assets and liabilities you add for net worth, and the values you record for them;
• receipt drafts and the images attached to entries;
• exchange rates you type in yourself, or fetch when you ask for them;
• your settings, such as base currency, when your month starts, theme, reminders and default account.

All of it is written to a database inside the app's private storage on your device. Insights, forecasts, Can I afford this?, savings plans, coaching tips, your weekly summary and the month-end review are all worked out on your phone from this data. You can use CashSpell without an account, and then nothing you enter is sent to us or to anyone else. Signing in is optional; if you do, your ledger syncs as described in the next section.

03Signing in and sync

CashSpell has optional accounts. You can sign in with an email address and password, with Google, or, on iPhone, with Sign in with Apple. Sign-in is handled by Firebase Authentication, a Google service, which keeps your email address and sign-in details under Google's privacy policy. If you sign in with Google or Apple, that company tells Firebase who you are; the app never sees your Google or Apple password.

Your ledger syncs while you are signed in. The records you enter are sent to CashSpell's server at api.cashspell.com, so the same ledger appears on every phone you sign in to. The server runs on Cloudflare Workers, placed in the EU, and keeps your ledger in a database hosted by Supabase in the EU (Ireland). Receipt images, cloud backups and profile photos are stored in Cloudflare R2, in Western Europe. Each request carries proof of which account is signed in, and the server only ever returns your own records to you.

Other things you can choose to do while signed in also go through that server: cloud backups you make, shared groups and the expenses, names and profile photos you add to them, and the payment details you choose to share for settling up, such as a PayPal.me or Venmo handle, a bank account number or a note, which members of your groups can see, and group invites, where the address you enter is used to email the invite through our email provider, Brevo, and is not kept. If you report something in a group, the report, a copy of what you reported, your name and your account ID are kept and emailed to us so we can look into it.

Signing out removes your ledger from that phone.

04Voice and speech recognition

When you add an entry by voice, the app uses your phone's own speech recognition, and only in its on-device mode: on iPhone, Apple's speech recogniser is set to require on-device recognition, so it never sends your voice to Apple's servers; on Android, the app uses the phone's on-device recogniser, available from Android 13. If your phone cannot recognise your chosen language on the device, voice entry is not offered, rather than falling back to a server. No audio leaves your phone, and no recording is kept.

The words recognised are turned into an entry card on your phone. If you have allowed AI help, those words, not the audio, may be sent for a sharper reading as described under AI help. The microphone is used only while the voice screen is open.

05Receipts, camera and photos

You can scan a receipt with the camera, pick one from your photos, or share an image or PDF into CashSpell from another app. On Android, scanning uses Google's document scanner, part of Google Play services on your phone; on iPhone, Apple's VisionKit. The text is read on your phone, by Google ML Kit text recognition on Android and Apple's Vision on iPhone, and the merchant, total, date, tax and items are filled in on your phone. Before an image is kept, the app removes its location and other embedded details and makes it smaller.

Images are kept with the entry in the app's private storage. If you are signed in, they are uploaded to our server, stored in Cloudflare R2 under your account, and downloaded to your other signed-in phones when you open the entry. An image is deleted from our server when no entry or draft uses it any more, and with your account.

The camera and photos are also used, only if you choose, for your profile photo, which is uploaded and shown to the members of your groups.

06Receipts by email

With Pizza Max and an account, you get a private address ending in @receipts.cashspell.com, made of random letters and numbers. Email sent to it is received by Cloudflare Email Routing and handed to our server, which:

• does not keep the original message;
• keeps the subject and the message text as a receipt draft in your ledger, and saves attached images as receipt images, both of which sync to your phones like anything else in your ledger;
• keeps the message text and up to five attached PDFs in Cloudflare R2 for 30 days, after which they are deleted automatically;
• drops mail without keeping it if the address is unknown, your plan does not include receipts by email, or more than 50 have arrived that day.

The draft is read on your phone at the next sync, and nothing is added to your ledger until you confirm it. Anyone who knows your address can send to it, so share it only where you forward receipts from. You can generate a new address at any time in Settings › Receipts by email, and the old one stops working at once.

07AI help

Speech, typed sentences and receipts are always read on your phone first, with no AI service involved. If you have Pizza Max and are signed in, CashSpell can also ask an AI service for a sharper reading. It asks first: nothing is sent until you tap Allow on the notice it shows, and you can turn it off at any time in Settings › Privacy, after which everything is read on your phone again. If the AI service fails or is unreachable, the phone's own reading is used.

What is sent. The app sends the request to our server, never directly to an AI provider, and our server passes it on:

• for a spoken or typed entry: the words, up to 500 characters, with the names of your open accounts, your categories and your payees, your base currency and today's date, so the answer can use your own names;
• for a receipt you scan, pick, share in or forward: the text read from it, the image, your base currency and today's date.

Our server does not send your name, email address, account ID or any device identifier to the AI provider.

Who it goes to. Requests pass through Cloudflare AI Gateway, with its request logging turned off, to one of these providers, tried in an order we set:

• Cloudflare Workers AI, which runs open models, currently Meta's Llama, on Cloudflare's own servers;
• Google Gemini, through OpenRouter, currently Gemini 2.5 Flash and Flash-Lite. OpenRouter passes the request on to Google. Every OpenRouter request requires zero data retention and refuses data collection, so it may only be routed to providers that do not keep or train on it.

We only configure providers whose terms rule out training AI models on what we send. If we add or change a provider, we will update this list first.

What we keep. Our server does not store or log what you said, typed or photographed, or the answer. For each request it keeps a one-way, salted fingerprint of the request for up to 24 hours, so the same request is not counted twice, and a count of requests per month for your account. Nothing is saved to your ledger until you confirm the card.

AI can get things wrong. Always check an AI-filled card before you confirm it.

08Plans and purchases

Coffee Plus, Burger Pro and Pizza Max are subscriptions sold through the Apple App Store and Google Play. You can buy one with or without a CashSpell account. Payment is taken by Apple or Google under their own privacy policies; we never see your card or payment details.

Purchases are managed by RevenueCat, a subscription service. The app identifies you to RevenueCat by a random identifier, never by your name or email address: your CashSpell account ID if you are signed in, or otherwise an anonymous ID that RevenueCat makes, which is joined to your account ID when you sign in. RevenueCat receives your purchase and renewal details from the store, along with the technical details its software needs, such as the app version and platform. RevenueCat tells our server about changes to your plan, and our server keeps your plan, the product and store, when it renews or ends, whether it will renew, whether there is a billing problem, and RevenueCat's customer ID, so your plan works on every phone you sign in to. If you buy without signing in, the plan stays between the app, RevenueCat and the store until you sign in.

09Usage analytics

To learn which features get used, so we know what to improve, the app can send usage analytics to Google Analytics for Firebase. Whether it does at first depends on where your phone is set to:

• In the European Union, the European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland, the app asks first. When you set it up, it asks whether to share how you use the app, with two equal answers and neither chosen for you, and nothing is sent unless you say yes. If you never answer, nothing is sent.
• Everywhere else, it is on unless you turn it off.

The app goes by the country in your phone's language and region settings; it does not look up where you are. If it cannot tell which country that is, it asks first, as it does in the EU. Analytics works the same whether or not you are signed in.

What is sent:

• that you finished setting up the app, and whether you chose to write down a first expense then;
• that you saved an entry, and whether it was spending, income or a transfer;
• that you ran a search, or exported your entries;
• when the app is opened, and for how long it is used;
• your phone's model and system version, the app's version, your language and your rough country;
• a random ID for this install of the app, which is replaced with a new one if you turn analytics off and on again.

What is never sent:

• anything you write in your ledger: no amounts, balances or budgets, no payees, notes, categories, tags or account names;
• what you search for, say or scan;
• your name, email address or phone number;
• advertising identifiers: the app does not collect the Android advertising ID, and on iPhone it does not use the identifier for vendors or allow ad personalisation.

In every region, the app tells Google Analytics through its consent settings that nothing it sends may be used for advertising: ad storage, ad user data and ad personalisation are always denied, and analytics storage is granted only while analytics is on.

Analytics is not linked to your CashSpell account, and nothing is sent while you are exploring the sample ledger.

How to change your choice: open Settings › Privacy and switch Share usage analytics on or off. Your choice is kept, and it applies wherever you are. When you switch it off, nothing more is sent from that moment, and the install's analytics ID is reset. You can switch it back on in the same place.

The app does not include advertising of any kind, crash reporting or remote logging.

10Notifications

Reminders to log, bills and budgets, the weekly summary, insights and other reminders are scheduled on your phone; our server sends none of them and does not know when they are due.

If you sign in, the app registers this phone with Firebase Cloud Messaging, a Google service that on iPhone delivers through Apple's push service, so our server can tell the phone there is something new to sync and send group notifications. Our server keeps the phone's push token, an ID for this install of the app, your notification switches, quiet hours and time zone. A sync message carries nothing from your ledger. A group notification can include the group's name and a member's name, but never an amount, description or note.

11The update check and exchange rates

When the Android or iPhone app starts, it downloads one small file from cashspell.com. The file lists the oldest version of CashSpell that is still supported and a link to the store. If the version on your phone is older than that, the app asks you to update before you continue.

The request contains nothing you entered, and no account, advertising identifier or device identifier. As with any web request, the server that answers it receives your IP address, the name of the software making the request and the time. That is handled like any other visit to this website, as described in the website section below, and we do not use it to identify or track you.

If you are offline, or the file cannot be reached, the app opens normally.

Exchange rates, only when you ask. If you tap Fetch rates on the Exchange rates screen, the app asks Exchange Rate API (open.er-api.com) for the rate of each currency your accounts use, one request per currency. Each request names a currency code, such as EUR, and nothing else: no amount, no account, nothing you entered, and no advertising or device identifier. As with any web request, that service receives your IP address, the name of the software making the request and the time, and handles them under its own privacy policy. Nothing is fetched unless you tap Fetch rates. A rate you typed yourself is never replaced unless you choose the fetched one, and entries you have already saved keep the rate they were saved with. If you are offline, or the service cannot be reached, the rates you already have stay in use.

12App lock, PIN and biometrics

If you turn on the app lock, your PIN is not stored. The app keeps a one-way hash of it on your device, which can check a PIN but cannot be turned back into one.

Unlocking with a fingerprint or Face ID is handled entirely by your phone's operating system. The app only receives a yes-or-no answer. It never sees, stores or transmits your fingerprint or face data.

The lock can also keep your balances out of the app switcher. On Android this uses the system's secure-window setting, which also blocks screenshots and screen recording inside the app while it is on. While the lock is on, the Left to spend widget shows no amount.

13Device permissions

• Android: INTERNET for the update check, exchange rates when you tap Fetch rates, usage analytics, signing in, sync and AI help; USE_BIOMETRIC, only used if you turn biometric unlock on; RECORD_AUDIO, asked for the first time you add an entry by voice; POST_NOTIFICATIONS, asked for so reminders and group updates can reach you; RECEIVE_BOOT_COMPLETED and VIBRATE, so reminders you set survive a restart and can vibrate; and Google Play's BILLING, to buy a plan. Scanning a receipt or picking a photo uses the system's own scanner, camera and photo picker, so the app does not need camera or storage permissions.
• iPhone: the app asks to use Face ID when you turn on biometric unlock; the microphone and speech recognition when you first add an entry by voice; the camera when you scan a receipt or take a profile photo; your photo library, where iOS asks for it, when you pick a receipt or profile photo; and notifications, for reminders and group updates.

The app does not ask for access to your location or contacts. You can withdraw any of these permissions in your phone's settings; the features that need them stop working, and everything else carries on.

14Exports you choose to share

When you export your entries to a CSV or Excel file, an archive or a year-end report, the file is created on your device and handed to your phone's share sheet. You decide where it goes, whether that is email, a chat, a files app or a cloud drive. CashSpell does not upload it anywhere. Once shared, the file is handled under the privacy policy of the service you sent it to.

15Backups

Backups in the app. A backup is a copy of your whole ledger at one moment. It is kept on your phone, and, if you are signed in, also on our server in Cloudflare R2, encrypted with AES-256 using a key that only our server holds, so it can be restored on any phone signed in to your account. Settings that belong to one phone, such as the app lock, are never in a backup. Cloud backups stay until you delete them or your account.

Your phone's own backup. If your phone's own backup is switched on, such as Google's Android backup or iCloud, it includes your CashSpell ledger and receipt images, so a new phone or a restored one can get them back. Those backups are made and stored by Google or Apple under their privacy policies, not by us. The app lock, the backups kept on the phone and any voice recordings are left out of them on purpose, so records restored from a phone backup come back with no PIN set.

16Contacting support

Contact support and Request a feature in the app open your own mail app with a message to support@cashspell.com; nothing is sent until you send it. Contact support can attach four lines of diagnostics, only if you switch that on: the app version, your phone's maker, model and system version, the app's database version and whether it is syncing. You see them before you send, and your transactions, amounts and accounts are never attached. Request a feature can attach the app version, if you choose. We use what you send only to answer you and improve the app.

17Links that open your browser

Some links in the app, such as this policy, the terms and the delete-your-account page, open in your web browser. Visiting them is an ordinary website visit, covered by the website section below. Group invite links at cashspell.com/join open the app if it is installed.

18The web version

The web version of CashSpell is being built on the same principle. It will keep your entries in your browser's storage on the device you use, not on our servers. If anything about that changes, we will update this policy before the web version is released.

19This website

This website sets no cookies, runs no analytics and loads no trackers or third-party fonts. The one exception for scripts is the delete-your-account page, which loads Google's Firebase sign-in scripts so you can sign in again before deleting; they run only on that page. Like any website, the service that hosts it may keep standard server logs, such as IP address, browser type and the page requested, for a short time to keep the site secure and running.

20Who handles your information

We do not sell or rent your information, and we do not share it with advertisers, data brokers or other apps. These services handle it for us, only to provide the features described on this page:

• Google (Firebase): sign-in, usage analytics and push messages; and on Android, the document scanner and text recognition, which run on your phone;
• Apple: Sign in with Apple, push delivery to iPhone, and the scanner, text and speech recognition, which run on your phone;
• Cloudflare: our server, file storage, receiving receipt emails, and AI help through Workers AI and AI Gateway;
• Supabase: the database that holds synced ledgers;
• OpenRouter, and through it Google's Gemini models: AI help;
• RevenueCat, with Apple and Google as the stores: plans and purchases;
• Brevo: emails we send, such as group invites and account deletion confirmations;
• Exchange Rate API: exchange rates, when you ask for them.

We may also disclose information if the law requires it.

21How long we keep it

• Your synced ledger, receipt drafts and images, profile photo and cloud backups: until you delete them or your account.
• Receipt email text and PDFs: 30 days.
• AI request fingerprints: up to 24 hours. Counts of AI requests: per month, with your account.
• Our server's request logs, which record the address requested, the result and the country but never what you sent: a short time, for running and securing the service.

Deleting your account, in Settings or from the web, deletes from our server your ledger, receipt drafts and images, forwarded receipt emails, cloud backups, profile photo, push registrations, plan record and your receipts-by-email address, and deletes your sign-in from Firebase. A confirmation is emailed to a verified address. We keep a one-way hash of your account ID so other phones still signed in to it are signed out and cleared. In shared groups, your name stays in the group's history and what is owed stays as it was. Deleting your account does not cancel a subscription; cancel it in your store first. RevenueCat keeps its record of past purchases, linked only to the random account ID; write to us if you want it removed.

22Your control over your data

You can view, edit and delete everything in the app at any time. Deleted entries go to the Trash for 30 days, where you can restore them or remove them for good. Uninstalling the app, or clearing its storage in your phone's settings, permanently deletes all of its data from that device.

Privacy laws such as the GDPR, UK GDPR and the California Consumer Privacy Act give you rights to access, correct, export and delete your data. If you have not signed in, your data exists only on your device, so you already hold those rights directly, and we cannot recover it if your device is lost or the app is removed; make a backup regularly. If you have signed in, you can delete your account and its synced ledger from Settings. In the EU, the EEA, the UK and Switzerland, usage analytics is sent only with your consent; you can give or withdraw it at any time in Settings › Privacy, and anywhere else you can turn it off there. AI help is used only after you allow it, and you can turn it off in the same place. For anything else, write to us at the address below.

23Security

Your data sits in the app's private storage, which other apps cannot read. We recommend using a screen lock on your device and turning on CashSpell's app lock. Everything the app sends to our server, and our server sends on, travels over an encrypted connection, and cloud backups are encrypted when stored. No method of storing information is perfectly secure.

24Children

CashSpell is not directed at children under 13. We do not knowingly collect information from anyone, including children.

25Changes to this policy

If we change how CashSpell handles information, we will update this page and the date at the top before the change takes effect. A significant change will also be described in the app's release notes.

26Contact

Questions or concerns about privacy can be sent to support@cashspell.com. You can also read our terms and conditions.